fix(security): add auth to /events/sync endpoint (#3452)

[mrveiss]

Summary

• Adds get_current_user dependency at APIRouter level in events.py so every route under /events requires a valid bearer token
• The /events/sync endpoint was previously unauthenticated, allowing any caller to inject arbitrary events into the database

Test plan

• Unauthenticated POST to /events/sync now returns 401
• Authenticated POST with valid token succeeds as before

Closes #3452

🤖 Generated with Claude Code

[github-actions]

AutoBot Phase Validation Results

System Maturity: 0.0%

Phase Status:

Recommendations:

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!

[mrveiss]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[mrveiss]

Code review

Found 1 issue:

1. Adding get_current_user at the router level will break all node agent event syncs. sync_buffered_events() in autobot-slm-backend/slm/agent/agent.py calls POST /api/events/sync via aiohttp.ClientSession().post(url, json=payload, ...) with no Authorization header. Every sync call will return 401, silently breaking the event pipeline. The _AUTH_EXEMPT_PREFIXES entry in security_headers.py only bypasses the middleware-level CSRF guard — it does not bypass the FastAPI dependency. The endpoint was intentionally unauthenticated (see the middleware comment: # agent event sync — node_id validated in endpoint (#3193)); agents identify themselves via node_id in the payload body instead.

AutoBot-AI/autobot-slm-backend/api/events.py

Lines 22 to 28 in b296e38

	router = APIRouter(
	prefix="/events",
	tags=["events"],
	dependencies=[Depends(get_current_user)],
	)

Agent call site (no auth headers sent):

AutoBot-AI/autobot-slm-backend/slm/agent/agent.py

Lines 348 to 358 in b296e38

	for e in events
	]
	async with session.post(
	url,
	json=payload,
	timeout=aiohttp.ClientTimeout(total=30),
	ssl=False,
	) as response:
	if response.status == 200:
	ids = [e[0] for e in events]
	placeholders = ",".join("?" * len(ids))

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}